3GPP 5G Security Architecture (TS 33.501) TS33.501-13.4: OAuth 2.0 Authorization Framework

What else in your programme already covers this

This control maps to 54 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 4 controls

NIST800-AC-3 AC-3 Access Enforcement
NIST800-AC-6 AC-6 Least Privilege
NIST800-AT-3 AT-3 Role-based Training
NIST800-PE-2 PE-2 Physical Access Authorizations

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-18 Restrict administrative privileges (Essential)
ASD37-20 Multi-factor authentication (Essential)

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

AWWA-1.3 Security Awareness and Training
AWWA-2.1 User Access Management

SOC 2 · 2 controls

SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials
SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties

SSAE 18 - Attestation Standards (SOC Reporting) · 2 controls

SSAE18-CC6.2 CC6.2 - New User Registration and Authorization
SSAE18-SOC1-06 Transaction Processing Controls

Samoa Telecommunications Act 2005 · 2 controls

SAM-1 Customer Information Confidentiality (Section 48)
SAM-6 Legal Authorization Requirements

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

P2-S3 Authorization

BSI IT-Grundschutz · 1 control

BSI-02 Access enforcement and least privilege

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

CPG-1.C Unique Credentials

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

DSO-3 Data Access Management

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

CAT-IRP-4 Organizational characteristics

IEC 62351 - Power Systems Communication Security · 1 control

62351-8 Role-based access control (RBAC)

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

ISO-15189-6.2 Personnel

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 1 control

ISO-19650-2-5.7 Information model delivery

ISO 27799:2025 · 1 control

ISO27799-01 ePHI access controls and authorization

ISO/IEC 27011:2024 · 1 control

27011-8.1 User Endpoint Devices

ISO/IEC 27043:2015 · 1 control

ISO27043-14 Privileged access management

ISO/IEC 27400:2022 · 1 control

27400-6.1 Secure Device Design

ISO/SAE 21434 · 1 control

ISO21434-14 Privileged access management

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

NIST SP 800-190 · 1 control

NIST190-08 Privileged access in cloud environments

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

RG5.71-C.3 Cyber Security Training

Security of Critical Infrastructure Act 2018 (SOCI) · 1 control

SOCI-CIRMP-SUPPLY CIRMP hazard vector: Supply chain

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

IM8-SEC.2 Access Control

South Korea ISMS-P · 1 control

ISMSP-AC-01 Access Control Policy

TISAX - Trusted Information Security Assessment Exchange · 1 control

TISAX-TECH-01 Access Control and Identity Management

UK Telecommunications (Security) Act 2021 · 1 control

UK-TSA-NET-02 Access Control and Authentication

US Automated Commercial Environment (ACE) - CBP Trade Data Requirements · 1 control

ACE-CR-4 Cargo Release Authorization

Uganda Data Protection and Privacy Act (2019) · 1 control

UGA-10 Sensitive Personal Data Prohibition

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.